[webapi] Fix more security issue form zap scan

- Use "error" instead of exception message
- Set "HttpOnly" to all cookies
- Turn off AUTOCOMPLETE attribute in form input element containing password by using autocomplete="off"